FreeIPA and Samba 3 Integration

FreeIPA makes a pretty excellent backend for Samba 3. While all the information one needs to set this up is available online, I wasn’t able to find it all in one location so I’ve decided to try my best at filling that gap here on techslaves.org. Hopefully this short guide will aid those trying to piece together the various parts necessary to integrate FreeIPA v2 and Samba 3, at least until FreeIPA v3 where there is talk of enabling Samba integration with a simple command line argument to the “ipa-server-install” script.

Not for Domains

It’s important to keep in mind that these instructions are not for a integrating FreeIPA with a Samba domain controller but merely a Samba file server. My understanding is that FreeIPA will never conveniently/properly support the necessary bits to make it a suitable backend for a Samba 3 PDC. I believe FreeIPA will eventually look towards Samba 4 integration (using Domain trusts) for this kind of integration but don’t quote me on that. Either way, these instructions are not for Samba domain controllers, just Samba file servers.

The Assumptions

There are some basic assumptions that these instructions make.

FreeIPA is installed and functional

You have a general idea of how to use LDAP command line tools

If you have a nice GUI LDAP browser, you can use it to apply the example LDIFs and edit the tree instead of the ldap CLI tools

The LDAP commands are executed on the FreeIPA server

Samba and FreeIPA are installed on the same server (although it shouldn’t be difficult to use TLS encryption with separate servers)

Your LDAP suffix is “dc=domain,dc=tld”

You know the difference between the “admin” account and the directory manager and their passwords

The Goods

Let’s not beat around the bush any further.

Determine your Samba server SID by executing the following command while smbd is running and jot it down:

With the directory manager password and the Samba SID you jotted down from above, create an instance of the 389 DS DNA plugin that will automatically generate SIDs for your users and groups which are necessary for use with Samba:

The thing to note here is that the “dnaprefix” is set to the SID your jotted down… PLUS a hyphen (“-“) appended to the end!

Now we have to start modifying the FreeIPA API, CLI and WebUI to allow us to specify the “sambaGroupType” attribute at group creation time. We have to set “sambaGroupType” because it is a required attribute for the objectClass “sambaGroupMapping” which we are automatically adding to every group with the “ipaGroupObjectClasses” setting from earlier.

Although the value is going to be “4” for every conceivable case in this non-domain configuration, I was not able to figure out how to make the DNA plugin insert static values like it can set incrementing values so I decided to allow setting it through the CLI and WebUS with defaults enabled instead. If anyone knows how to setup 389 to automatically add an attribute with a static value upon DN creation of DNs with specific objectClasses, please tell me.

There are a few steps required to make this CLI/UI stuff happen but the FreeIPA developers have actually made this quite simple.

The rule is: Extend the FreeIPA schema first, then the CLI, then the WebUI.

4.1. Extend the FreeIPA schema with a custom field by adding the attribute “ipaCustomFields” with a value of “Samba Group Type,sambagrouptype,true” to “cn=ipaConfig,dc=etc,dc=domain,dc=tld” with an “admin” kerberos ticket:

As there can only be one “ipaCustomFields” attribute, if you have multiple custom fields you need to separate each definition with a “$” like so: “Samba Group Type,sambagrouptype,true$Description,attrname,isrequiredboolean”.

4.2. Extend the CLI for groups by editing the python file “/…/site-packages/ipalib/plugins/group.py” to define the custom field and specify a default if not implicitly defined (diff):

Whilst attempting to patch the group.js it’s became quickly clear that the curent group.js file has been updated and changed quite significantly.

It looks like they’ve re-organised the layout of said group.js file and it’s nigh impossible to quite nail where the selector content and the results of the selector fit in to their new .js (not a JS expert here as you can imagine) is there any hints you or help you could possibly pass on to us poor struggling to get Samba 3 souls here?

The .py and everything else works like a charm but it’s just that last part we’re banging heads about.

I got it to work, although the samba group type column in the group list is empty. Here are the diffs to the files I had to edit:--- /usr/lib/python2.6/site-packages/ipalib/plugins/group.py.orig 2015-03-18 04:35:51.702586747 -0400
+++ /usr/lib/python2.6/site-packages/ipalib/plugins/group.py 2015-03-18 04:39:48.987069967 -0400
@@ -160,6 +160,13 @@
doc=_('GID (use this option to set it manually)'),
minvalue=1,
),
+ Int('sambagrouptype',
+ cli_name='sgt',
+ label=_('Samba Group Type'),
+ doc=_('Samba Group Type (default is 4)'),
+ default=4,
+ autofill=True,
+ ),
)

@Martin: Better (extremely) late than never but… did you restart httpd after editing group.py?

@David: You’re not missing any part of the article, this is it. The samba configuration basically looks like any other samba configuration with an “ldapsam” backend. Hope that helps. If not, I can point you to some articles about configuring samba for LDAP authentication.

The only thing I’ve done differently (as far as I can tell) is that the samba server is a separate machine than the IPA-server but I’ve verified that it works so far that I can do, for example, getent passwd admin so apparently IPA itself is working properly.

Thanks, this looks like exactly what I need.
I have one question though: how many of these changes will get propagated to the rest of the FreeIPA cluster automatically? (assuming there are more than one FreeIPA servers in the network)